8 ms·

All providers are in on this "free" public DNS scam for the same reason, and it makes me wonder why anyone would voluntarily donate their entire home's click an

by dmw_ng 5y ago

All providers are in on this "free" public DNS scam for the same reason, and it makes me wonder why anyone would voluntarily donate their entire home's click analytics to a super-aggregator free of charge. Did I miss the link to the payment page? Cisco at least release some low frequency summaries of the data they are able to collect: https://s3-us-west-1.amazonaws.com/umbrella-static/index.html https://s3-us-west-1.amazonaws.com/umbrella-static/index.htm...

apecat 5y ago
Cloudflare's public DNS's privacy promises are audited by KPMG https://www.bleepingcomputer.com/news/security/cloudflares-1111-dns-passes-privacy-audit-some-issues-found/ https://www.bleepingcomputer.com/news/security/cloudflares-1...
- dmw_ng 5y ago
  That is almost 2 years old, and does not seem to cover aggregate processing applied before the logs are deleted. FWIW stripping the last octet is the same as happens in EDNS, it is far from anonymous.
  - cnst 5y ago
    So, they basically still collect, log and process the exact same data as Google DNS, but disallow anyone else from having it, breaking legitimate uses of DNS for GeoIP targeting and DoS mitigation? How convenient!
    - yjftsjthsd-h 5y ago
      > legitimate uses of DNS for GeoIP targeting and DoS mitigation What legitimate uses would those be, and how is DNS involved in DoS mitigation?
      - cnst 5y ago
        A good example is Cloudflare's own CDN business — they require you to delegate your domain name to their DNS servers by name, not by IP address with your own glue records on your own domain name. Because they want to be able to use all the resources available to stop DDoS, including EDNS Client Subnet provided by other resolvers. Same goes for GeoIP — EDNS Client Subnet was specifically created for effective and cheap GeoIP. (BGP anycast isn't cheap.) I mean, both issues are exactly why archive.is had to put the block in place. For sure both of these usecases are pretty legitimate. BTW, what's the actual legitimate need to block ECS? After a domain name is resolved by DNS, you still have to connect directly to the hostname by an IP address, and your IP will be leaked — there's no way around this, that's how internet works. Cloudflare knowingly runs these marketing campaigns trying to obscure this simple fact that easily invalidates the need for their services, and invalidates the benefits of their service compared to competition.
  - apecat 5y ago
    The current product page still states that "a big four accounting firm" audits the service's privacy policy on a yearly retainer https://one.one.one.one/dns/ https://one.one.one.one/dns/
moviuro 5y ago
Use a DoH/DoT oblivious proxy? I have no idea if anyone commercializes that. https://try.popho.be/doh-proxy.html https://try.popho.be/doh-proxy.html
- dmw_ng 5y ago
  I'd much rather the opposite: an honest public DNS service that offers all data collected to the public, with some premium paid for high frequency data, and free from any conflict of interest. I would happily use a service like this since I could benefit from it. The business case to collect DNS statistics is clear and imminently useful to numerous people and organizations, it's the complete lack of honesty about why they offer the service that bothers me.

by dmw_ng 5y ago

apecat 5y ago

Cloudflare's public DNS's privacy promises are audited by KPMG https://www.bleepingcomputer.com/news/security/cloudflares-1111-dns-passes-privacy-audit-some-issues-found/ https://www.bleepingcomputer.com/news/security/cloudflares-1...

dmw_ng 5y ago
That is almost 2 years old, and does not seem to cover aggregate processing applied before the logs are deleted. FWIW stripping the last octet is the same as happens in EDNS, it is far from anonymous.
- cnst 5y ago
  So, they basically still collect, log and process the exact same data as Google DNS, but disallow anyone else from having it, breaking legitimate uses of DNS for GeoIP targeting and DoS mitigation? How convenient!
  - yjftsjthsd-h 5y ago
    > legitimate uses of DNS for GeoIP targeting and DoS mitigation What legitimate uses would those be, and how is DNS involved in DoS mitigation?
    - cnst 5y ago
      A good example is Cloudflare's own CDN business — they require you to delegate your domain name to their DNS servers by name, not by IP address with your own glue records on your own domain name. Because they want to be able to use all the resources available to stop DDoS, including EDNS Client Subnet provided by other resolvers. Same goes for GeoIP — EDNS Client Subnet was specifically created for effective and cheap GeoIP. (BGP anycast isn't cheap.) I mean, both issues are exactly why archive.is had to put the block in place. For sure both of these usecases are pretty legitimate. BTW, what's the actual legitimate need to block ECS? After a domain name is resolved by DNS, you still have to connect directly to the hostname by an IP address, and your IP will be leaked — there's no way around this, that's how internet works. Cloudflare knowingly runs these marketing campaigns trying to obscure this simple fact that easily invalidates the need for their services, and invalidates the benefits of their service compared to competition.
- apecat 5y ago
  The current product page still states that "a big four accounting firm" audits the service's privacy policy on a yearly retainer https://one.one.one.one/dns/ https://one.one.one.one/dns/

moviuro 5y ago

Use a DoH/DoT oblivious proxy? I have no idea if anyone commercializes that. https://try.popho.be/doh-proxy.html https://try.popho.be/doh-proxy.html

dmw_ng 5y ago
I'd much rather the opposite: an honest public DNS service that offers all data collected to the public, with some premium paid for high frequency data, and free from any conflict of interest. I would happily use a service like this since I could benefit from it. The business case to collect DNS statistics is clear and imminently useful to numerous people and organizations, it's the complete lack of honesty about why they offer the service that bothers me.